Encapsulated security tokens for electronic transactions
Functional data for use in one or more digital transactions are secured by using an encapsulated security token (EST). In certain embodiments, the EST is created by encapsulating digital data including the functional data using at least two cryptographic systems of two parties. The encapsulation and subsequent de-encapsulation can utilize cryptographic systems of the parties that involve a private key for signing and decryption and a public key for encryption and signature verification. If constructed carefully over a series of rigorous events, the resulting EST can be practically impossible to counterfeit. In addition, a propagation of rights can be tracked for auditing and rights can be easily terminated or modified.
1. A method for use in propagating authority to use functional data in connection with a digital transaction, comprising the steps of:
receiving first digital data including at least functional data;
adding to said first digital data at least first authorization data to identify a first authorized party and originator credential data to identify an originator of the functional data;
generating a first encapsulated security token by encapsulating at least (i) said first authorization data and (ii) said originator credential data using at least a first cryptographic system including a digital signature of the originator and an originator signature verification;
generating a twice-encapsulated security token by encapsulating at least (i) said first encapsulated security token and (ii) a second authorization data to identify a second authorized party using at least a second cryptographic system including a digital signature of the first authorized party and a first authorized party signature verification;
propagating said twice-encapsulated security token to said second authorized party;
receiving a proposed digital transaction including proposed authorization data of said second authorized party;
verifying authorization of said second authorized party for the proposed digital transaction by (i) de-encapsulating said twice-encapsulated security token using at least the originator signature verification and the first authorized party signature verification to obtain extracted authorization data including at least the first authorization data and the second authorization data and (ii) comparing the extracted authorization data with the proposed authorization data; and
responsive to verifying authorization of said second authorized party for the proposed digital transaction, using the functional data for the proposed digital transaction.
2. A system for use in propagating authority to use functional data in connection with a digital transaction, comprising:
one or more processors operative for:
receiving first digital data including at least functional data;
adding to said first digital data at least first authorization data to identify a first authorized party and originator credential data to identify an originator of the functional data;
generating a first encapsulated security token by encapsulating at least (i) said first authorization data and (ii) said originator credential data using at least a first cryptographic system including a digital signature of the originator and an originator signature verification;
generating a twice-encapsulated security token by encapsulating at least (i) said first encapsulated security token and (ii) a second authorization data to identify a second authorized party using at least a second cryptographic system including a digital signature of the first authorized party and a first authorized party signature verification;
propagating said encapsulated security token to said authorized party;
receiving a proposed digital transaction including proposed authorization data of said second authorized party;
verifying authorization of said second authorized party for the proposed digital transaction by (i) de-encapsulating said twice-encapsulated security token using at least the originator signature verification and the first authorized party signature verification to obtain extracted authorization data including at least the first authorization data and the second authorization data and (ii) comparing the extracted authorization data with the proposed authorization data; and
responsive to verifying authorization of said second authorized party for the proposed digital transaction, using the functional data for the proposed digital transaction.